From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f45.google.com (mail-qv1-f45.google.com [209.85.219.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B6F3B3E63A1 for ; Mon, 25 May 2026 09:29:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701346; cv=none; b=Dfan+UxUPm2FEdkodsXMkG2fvUvalmPqi6+IeKQs1j6SkAAkGyIAHeZMU4Cvl7azFpdE347D6qoiTH+6YoFC6qdhZrEp9VtbZeoLdYar30DF7VKABzeh00jSVmNtRPsbS3v7PPJOFWaXsW2PXp8Z9KuWA+urd6K6NFNy8DAVmp0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779701346; c=relaxed/simple; bh=aSVYpEez6Aw3aMw4yoHZCiaTJpswyN4Tsnuhzn+aSKw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QsJjEXZECRgesnIdNU209bBMpiETbva5jhnQADlnRlHQ2OV4I9Y1FlbcWo0hlwFgS/8zVh37MuPOe8Cs5RNGGQMJHrk6M/aDJcL3T8MO32LT+HbZrsEpWTVT2NETenBf91AH30jQaNdpyo+8UWq88ozcN5cwfAdob/AWLYC1UDo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=n7qC440Q; arc=none smtp.client-ip=209.85.219.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="n7qC440Q" Received: by mail-qv1-f45.google.com with SMTP id 6a1803df08f44-8b4eb1fd5d0so116846676d6.0 for ; Mon, 25 May 2026 02:29:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779701342; x=1780306142; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+/u6dFLgaY7n68TYn6Ld3RzN6PYRAr2JmUCcJULqcT0=; b=n7qC440Qy4xRfoZEOYrH71Zxu15QxQsQzAEeakQyYCxS3jEOTYf5wX9ud4yifTPIFS bu8aI3cpZFgJUS+8xPv9VJyCoLWMVyMaABtMklzW2EAPHqyrXwXfOzOMWITXwor/NMhh 5aIK4GXoMCda5RZgTYySKwkeCTY6pR9cF4lFjG9TD5x8+ZHR5MDSDukWDToXRImfQ/8N 1ZixY9KCDJxurZyN6/c6CWDqIXQW7JafHcFe3henWvSNijivcz4wZu9/qEjnCjDD13AL NxlHTXPTX2KsVH2FTZx0nG9N3IzswW3LzgqyT2Ss1MshyHwqdDLnPYmpfvTNbXRB/rX0 Hulw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779701342; x=1780306142; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=+/u6dFLgaY7n68TYn6Ld3RzN6PYRAr2JmUCcJULqcT0=; b=sCm7SHXlJcU0Ygamr9/GEFigD/gfC4SbvIjby7mC6pExHLu6GXWqTKECGN9dMVsslB YVrsiDo7Hcd4WPf4NQSxoh5AgKW9/6K5lthvbulnc6bz/BHIyZLVPQ42jtU6nyRWT2Em x+//BBuPM3Xd3TrIKHvdiR9Pyh2O16/Fga/YTWQzYbUNwz3oQYg11kzXr9Okj6bTx3GP ggDihUUXBRdal1PpeJsWiTsXmUo869w8HZnPafuh0JF67offFmickdVks94KptgwZlzF UkHB7D0ducgCme2nERNz07SZZ1MldpZ1FNpU2byroVnUrnuwn0fr1D6voxqUotb1S4dq dB4w== X-Forwarded-Encrypted: i=1; AFNElJ+luf1ZjxMvU3+hfu088HVuPXbEdooyNP33/Bj3W6VdIhjhKZ6aIDmP+yk+7I4CoGjflMHLw4dHlCs/Ndw=@vger.kernel.org X-Gm-Message-State: AOJu0YwkYILXQPgnbWUQEvvrk/Yfgbg+4ereIK4Z19A1ucOkxKrm5SFW wYIcP8ReOsonmF5FkyqSGV2MDN3GSb1GOMgLGzUQYaxDTZ5ee/45LGuQ X-Gm-Gg: Acq92OHXcN2aBr2lzn9bz8tWLNcyGcgqi1OUHfqwUHkRvPvhSrp0t/iRCDDhnA0PvCz e2BChAgn2bhOLpnYwe2iwy2C699xstV2EF53dz4zz88jUQx9xsWjLYKEorleSuqmLIUjaz4zeDK Ji5R8Jm9aYM500RtbbAzkhrSrKaglJrfqSojkMXTrllKwaaXXMnMQuPM8FYp1KJYigXmqQF0O7z U7so+h5DCewAsg/MaRUlj6EjAvel9OG1ltdG8Dpq7X6j1wk1Q9K0D2sSQNBz1kmpzYrwUuRvLYJ tIb5KmxlN2tNjTuB1jVU+/wWA/tYvDvJGrScTh+ochs8GuFPOXM4U+eXq/KANpHFmewLessKdpp Q0G6fVwluFWinyepVOWGgVG25eZD20slpXe6fkJ62hLOEzOqKHMYnfid7ER5unJp0nXUX0Ke7bn O1TQ/dOrEXy63CjodAXkTFs/GzoqKE+1ZgL9foa2xfhnyG5nqNC/r2YdvOgQNHDdtEyuPTrGxSP TKv/WVTD/5mrVfpFQz6oSqR5sUcNCcXvutdUpCvX3ukco9HMwttLg== X-Received: by 2002:a05:6214:3d88:b0:8cc:6b85:610b with SMTP id 6a1803df08f44-8cc7b5ff8f4mr230230136d6.47.1779701341602; Mon, 25 May 2026 02:29:01 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8cc80dcf4a9sm104255826d6.2.2026.05.25.02.29.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2026 02:29:01 -0700 (PDT) From: Michael Bommarito To: Mika Westerberg , Andreas Noever , Yehezkel Bernat Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/6] thunderbolt: clamp XDomain response data copy to allocation size Date: Mon, 25 May 2026 05:28:27 -0400 Message-ID: <20260525092830.735472-4-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260525092830.735472-1-michael.bommarito@gmail.com> References: <20260525092830.735472-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write past the kcalloc allocation. Clamp the per-packet copy length so that the cumulative offset never exceeds data_len. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito --- Confirmed over Thunderbolt 4 cable (Framework -> Dell, stock Ubuntu 26.04 7.0.0-15-generic). Also reproduced with KASAN on QEMU (7.1.0-rc3): BUG: KASAN: slab-out-of-bounds in tb_test_synthetic_overflow.cold+0x131/0x29a Write of size 192 at addr ffff888002110200 drivers/thunderbolt/xdomain.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c index 754808c43f006..4099419c74795 100644 --- a/drivers/thunderbolt/xdomain.c +++ b/drivers/thunderbolt/xdomain.c @@ -393,6 +393,8 @@ static int tb_xdp_properties_request(struct tb_ctl *ctl, u64 route, } } + if (req.offset + len > data_len) + len = data_len - req.offset; memcpy(data + req.offset, res->data, len * 4); req.offset += len; } while (!data_len || req.offset < data_len); -- 2.53.0